Many computer viruses and other malware can be detected by scanning for a signature pattern of bits associated with the malware. Among the ways viruses and other types of malware are designed to escape detection by virus scanner software is to obfuscate or scramble their malicious code into an unrecognizable format within a stored executable program module. Then, as the program is actively executing, the scrambled code is unscrambled by itself into executable code so that the CPU can execute the code. For example, different parts of a sequence of malicious instructions can be scattered and fragmented in the program in an inoperable and unrecognizable form prior to execution, and repositioned and combined during execution so they become operable. This technique is referred to as virus obfuscation. The obfuscated virus can be designed so that it may take several executions of the program module before the malicious code is fully assembled and ready for execution. An object of the present invention is to detect obfuscated malware.